By 'lag', I mean one port from each mc-lag peer connects to a port each on the uplink switch (consider this a single switch spine). The mc-lag is an active-active forwarding pair for L2 traffic (aruba's vsx solution). The reason I ask is that I have been told "If uplink is a lag, then it is not a route-only-port (i.e. not L3). The ebgp packet from remote neighbor can end up in any of the mc-lag peers. Hence ebgp multihop is required to be configured to 2, since the packet can go from North to sec, sec to pri. Similarly, it can go from north to pri to sec."

I don't understand how this works.

  • If its not a rop towards uplink, if dst is pri, if packet reaches sec, sec will not decrement ttl right ?

  • How does this lag work ? Are there two different IPs ? (i think not) Is it one logical SVI IP or virtual IP ? Do both respond to the ARP or does only the primary always respond ?

  • They say because this is active/active, both the peers have independent BGP sessions to remote BGP peer.
  • You may want to more prominently identify the type of equipment referenced in your question/post. The answer is device-specific. Commented Jun 15, 2020 at 16:07
  • In addition, you may want to be specific who "they" are.
    – Teun Vink
    Commented Jun 15, 2020 at 18:50

1 Answer 1


It depends on how you want to use the link.

You can configure your MLAG normally, then have a dedicated VLAN run atop this MLAG and configure routing on this VLAN. This will work for static routing using the virtual IP as a next hop.

If you perform dynamic routing, like BGP, then it's still possible, but then you have to establish a session with each member and this require each peer to be correctly identified. That means you shouldn't use the virtual IP, but the real IP of the interface for each member. This defeat the purpose of the MLAG in the firs place. It is functionally equivalent to have two dedicated L3 link, with additional unneeded complexity and extra hops.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.